LI
Product
LimeSurvey
96
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 10High 27Medium 42Low 2
Watch
Add LimeSurvey to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-50636 | 8.8 | Jun 9 | LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection Affected: through 7.0 |
| CVE-2026-50635 | 8.8 | Jun 9 | LimeSurvey Password Reset Host Header Injection Discloses Reset Token Affected: through 7.0 |
| CVE-2024-42902 | 8.8 | Sep 3 | An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the… Affected: through 6.6.2 |
| CVE-2024-39063 | 8.8 | Jul 9 | Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF) Affected: through 6.5.12 |
| CVE-2021-44967 | 8.8 | Feb 24 | A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP… Affected: 5.2.4 |
| CVE-2019-16174 | 8.8 | Sep 9 | An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data… Affected: before 3.17.14 |
| CVE-2018-1000659 | 8.8 | Sep 6 | LimeSurvey version 3.14.4 and earlier contains a directory traversal in file upload that allows upload of webshell vulnerability in file upload functionality that can result in… Affected: through 3.14.4 |
| CVE-2018-1000658 | 8.8 | Sep 6 | LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via webshell Affected: before 3.14.4 |
| CVE-2018-1000053 | 8.8 | Feb 9 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete… Affected: 3.0.0 |
| CVE-2026-63361 | 8.5 | Aug 14 | LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup Affected: 7.0.5 |
| CVE-2026-15973 | 8.4 | Aug 26 | LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries Affected: 7.0.5 |
| CVE-2026-63107 | 7.7 | Jul 20 | LimeSurvey SSRF via REST API Survey Template Host Header Affected: through 6.17.10; through 7.0.4 |
| CVE-2025-56421 | 7.5 | Mar 10 | SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database Affected: through 6.15.3 |
| CVE-2025-41075 | 7.5 | Nov 20 | Multiple vulnerabilities in Limesurvey Affected: 6.13.0 |
| CVE-2025-41074 | 7.5 | Nov 20 | Multiple vulnerabilities in Limesurvey Affected: 6.13.0 |
| CVE-2019-16187 | 7.5 | Sep 9 | Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script Affected: before 3.17.14 |
| CVE-2019-16177 | 7.5 | Sep 9 | In Limesurvey before 3.17.14, the entire database is exposed through browser caching Affected: before 3.17.14 |
| CVE-2019-15640 | 7.5 | Aug 26 | Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image Affected: before 3.17.10 |
| CVE-2026-92730 | 7.4 | Sep 23 | LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name Affected: 7.0.14 |
| CVE-2026-91775 | 7.4 | Sep 23 | LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings Affected: 7.0.14 |
| CVE-2026-63360 | 7.4 | Aug 26 | LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint Affected: 7.0.5 |
| CVE-2026-102626 | 7.2 | Oct 2 | LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute Affected: 7.4.0 |
| CVE-2026-16809 | 7.2 | Aug 26 | LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering Affected: 7.0.5 |
| CVE-2022-43279 | 7.2 | Nov 15 | LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php Affected: 5.4.4 |
| CVE-2019-16186 | 7.2 | Sep 9 | In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions Affected: before 3.17.14 |
| CVE-2019-16185 | 7.2 | Sep 9 | In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions Affected: before 3.17.14 |
| CVE-2026-97685 | 7.1 | Sep 29 | LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations Affected: 7.3.0 |
Showing 27